Customers are increasingly storing sensitive material in resources provided in a multi-tenant environment. These resources, often referred to as “cloud” resources, can support the storage and/or processing of data, execution of code, or other such activities on behalf of a number of different customers or entities. Even within an organization or enterprise, there can be many different teams that own libraries or other code fragments that run in such hosted environments. Over time, the ownership of these libraries, fragments, and other such elements can change, such as during a reorganization or consolidation, refactoring, architectural changes, or simply as part of normal business operation. For the provider of the resources, which can be the organization or a third party, for example, it is critical to be able to have a clear understanding of who owns these elements in the event of operational issues, system migrations, or other processes related to the ongoing lifecycle support of a platform. While a conventional approach involves utilizing a type of central registry to establish and track identity, such an approach suffers from inconsistencies when there is not a mechanism to enforce ownership (e.g. build-time validation and/or signing). In a multi-tenant environment there will be challenges in enforcement since improper enforcement may result in an outage (i.e., a website being unavailable).